@bongos/core 1.19.957 → 1.19.959

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.957",
-  "core_contract": "1.19.957",
-  "source_commit": "48e752cc136cf78939c24f100a08934f3516ed57",
+  "core_version": "1.19.959",
+  "core_contract": "1.19.959",
+  "source_commit": "762c63db2672a1dac87eb25a78bd3a93717b6d1a",
   "source_ref": "HEAD",
-  "built_at": "2026-09-22T05:59:48.593Z",
+  "built_at": "2026-09-22T14:26:09.898Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 514,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2357,
+    "functional_verbatim": 2358,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2897,
-  "tree_sha256": "3689a1fe6b51b1bde5cd80dc5e42e2111685ccd0ebc8f39c411ac17f4e1ff040",
+  "file_count": 2898,
+  "tree_sha256": "f587a606503aa60197f7ffbed71f7a3df76cfafda2da9b932090732dfc2cc512",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2157,12 +2157,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "ea08a06744310c312420c4af1e0f67154e324fe2be552b6d5c2fc683e18a63e8"
+      "sha256": "77cb83609d2a80e2c7520746181ef858839d37e8c0997b5dce42127d0c4c119c"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "45091c4acfe82fa8968be566f8b14f414ee3df68772b13617cba55735de93d1e"
+      "sha256": "8d83ca0d16a1f9d0efc89f0331f6940592ce34e0dd6f92c448575497bce96548"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2692,7 +2692,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "d24452f51a99862ee117d68ebed98474ef8599cbbad464ad4ea07f19e760f528"
+      "sha256": "164da9dadc56356e91897f78786de7c42b32e37534971b6743985abeba81d718"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4497,7 +4497,7 @@
     {
       "path": "modules/government/protected-surfaces.json",
       "mode": "0000644",
-      "sha256": "3c70a4abe22d8720a57da14e1f6dbc659cc57b066c1c811c8130f20d6d586e20"
+      "sha256": "ad15115c455dc9eb8b7786ce704beb94b5c40fabe17806e88b5edffb20b164cf"
     },
     {
       "path": "modules/government/ranks.js",
@@ -4822,7 +4822,7 @@
     {
       "path": "modules/hall-ui/public/deploy.js",
       "mode": "0000644",
-      "sha256": "fca8216900a7ff1d0b48f87e3fd223ae15e61346980ba68e7721801fb971157a"
+      "sha256": "e3a4fa62e761dddfb54a1f13680eb64ff87c4d37e83fa41a846ebfe1f41d44c8"
     },
     {
       "path": "modules/hall-ui/public/diagram-viewer.css",
@@ -6542,7 +6542,7 @@
     {
       "path": "modules/provisioning/core-upgrade.js",
       "mode": "0000644",
-      "sha256": "d6ba41f0bdb775191f94a1b57903a3f22cee68a8e7552be92f6112d86b4090fd"
+      "sha256": "96c6b73411a489e5c41fd567123fa8ef35f7a757db0e1df0c0cafd720674b05f"
     },
     {
       "path": "modules/provisioning/credential-preflight.js",
@@ -6674,6 +6674,11 @@
       "mode": "0000644",
       "sha256": "1fb60b17c411d9529f4c0ecd0b3d1efc9b2061567a1b31bf74fa706e2e83b3d7"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_024_snapshot_schema_pending.sql",
+      "mode": "0000644",
+      "sha256": "1287440b0088a6451dd4df234e578e06fc6f3e892915e64cd6c6e1f09dadd9d5"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
@@ -8077,12 +8082,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e6926dbbee5927840a3de03f03dff14b05a04ecdc2dd974941f93cca760c745e"
+      "sha256": "e0d9870134171629f6021c929775456f72729ad7131249f17c5e99cd64d2405f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "4f9672ddf0e6238c689b8884f85fdb3a5c85174b934d0ab57c79d8bd49acab6a"
+      "sha256": "830c6340ff774389b6a391c8045116ccabc871a23ba09688e03380892f340a2a"
     },
     {
       "path": "public-docs/index.html",
@@ -9027,7 +9032,7 @@
     {
       "path": "scripts/gds/provision-core-upgrade.js",
       "mode": "0000644",
-      "sha256": "4a84f48518a6427e95bf23e273865b6b2753489b40737b9256191fd2a65562e1"
+      "sha256": "f22c31d00a50a312d7228922cbe70fedc503e704cc7f2cb33a8686a4954c1c1e"
     },
     {
       "path": "scripts/gds/provision-disconnect.js",
@@ -9892,7 +9897,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "8cb783238eaf296a3d057537b829ec14c7d3d65f380874af18861d6262cffb10"
+      "sha256": "70b35812cbf26b9ce8c25663bbc4fcce40272b4877b89baf70cd64a5fe90b3b3"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -10087,7 +10092,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "fdab385d81b456d0cf1197085a21cac0e3e57b6d89a8a7c890d10248a16f25bf"
+      "sha256": "73781b940ba631e4642209a973a119375f7ff12f23027033030b1c95f0cc45f7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10992,12 +10997,12 @@
     {
       "path": "tests/core_upgrade_door.mjs",
       "mode": "0000644",
-      "sha256": "7333e05011a080e5ac3a54bb1b07fb421db848ee2eb54c786f36c43058b9e587"
+      "sha256": "c4238e2f2e2c52f23fb6948f5e6545bc4880efe75eb9af229a455db6017db05c"
     },
     {
       "path": "tests/core_upgrade_runner.mjs",
       "mode": "0000644",
-      "sha256": "f8bc5b5329c4de27b41a9172e6b5023c4854d864f532aac3ed062e0d35633f00"
+      "sha256": "85bc665f5d80ff1c7e8134e6be7dd8fa336b4fb50344164b034b0e72a963f04d"
     },
     {
       "path": "tests/cosmos_token_contrast.mjs",
@@ -11142,7 +11147,7 @@
     {
       "path": "tests/deploy_page_projects.mjs",
       "mode": "0000644",
-      "sha256": "cec0141f75e41dc268d9377db4925d8b8f0f6e9eb9b6b3c6b6c7c1eb07e75ac8"
+      "sha256": "5c582192ddd83ef289be692b12d898c8837b54312348751082478d036987a647"
     },
     {
       "path": "tests/design_tokens_sync.mjs",
@@ -11772,7 +11777,7 @@
     {
       "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "fd0cca1a62b8c2ab3bd556aabf4f6949bb6affb66c2fb1fd6258bccfffebc744"
+      "sha256": "4299e738542cd8951ec9846c4add158e902cb2ad29deba6c4afbfdb2b94877bf"
     },
     {
       "path": "tests/government_rank_sync.mjs",

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**1922 strings** across 3 surfaces · 1661 distinct pieces of copy · 1922 certain, 0 heuristic · 179 shown in more than one place.
+**1924 strings** across 3 surfaces · 1663 distinct pieces of copy · 1924 certain, 0 heuristic · 179 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 92 | 1427 |
+| `builders-hall` | `modules/hall-ui/public` | 92 | 1429 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
 | `landing` | `modules/public-landing/public` | 5 | 395 |
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `07f422cbdb7e` | 2x | ) and capture-resistant by design. | modules/public-landing/public/projects.html:1030, modules/public-landing/public/projects.html:1057 |
 | … | | _139 more in the JSON registry_ | |
 
-## `builders-hall` — 1427 strings
+## `builders-hall` — 1429 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -327,7 +327,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2366356926b4` | certain | Could not mark the primer just now. Try again. | `modules/hall-ui/public/primer.js:259` |
 | `753987b5da13` | certain | Could not reach the submit endpoint. | `modules/hall-ui/public/modules.js:297` |
 | `6f500726f0ac` | certain | Could not read the report: {…} | `modules/hall-ui/public/watch.js:640` |
-| `21c2f33168a3` | certain | Could not read this project's deploy state: {…} | `modules/hall-ui/public/deploy.js:310` |
+| `21c2f33168a3` | certain | Could not read this project's deploy state: {…} | `modules/hall-ui/public/deploy.js:322` |
 | `8b470cebf53d` | certain | Could not remove your key. Try again. | `modules/hall-ui/public/settings.js:1133` |
 | `4cf6bc8b377b` | certain | Could not remove. Try again. | `modules/hall-ui/public/settings.js:1132` |
 | `7a778d188e87` | certain | Could not remove: {…} | `modules/hall-ui/public/government.js:369` |
@@ -376,6 +376,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `a55e423263f0` | certain | Cross-project record | `modules/hall-ui/public/profile.html:94` |
 | `a55e423263f0` | certain | Cross-project record | `modules/hall-ui/public/settings.html:95` |
 | `24013a074724` | certain | Custom rank | `modules/hall-ui/public/government.html:113` |
+| `cf7d7d5d5e83` | certain | Database behind. | `modules/hall-ui/public/deploy.js:286` |
 | `6744aed3d15e` | certain | Dated exploit-detail engagement reports — kept out of the repo (threat-model §6.3) and served only to Archons. | `modules/hall-ui/public/watch.html:131` |
 | `7c6891813679` | certain | Default ({…}) | `modules/hall-ui/public/settings.js:63` |
 | `7ec7dc1adaa6` | certain | Deploy — {{worldName}} | `modules/hall-ui/public/deploy.html:6` |
@@ -639,7 +640,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `f14a91b3f625` | certain | Most recent first. Each row is one recorded work session; every id on it opens its record. | `modules/hall-ui/public/sessions.html:56` |
 | `e52ae74f0052` | certain | Move to goal | `modules/hall-ui/public/task.js:581` |
 | `e77d5f3beaef` | certain | Move to {…} | `modules/hall-ui/public/deploy.js:269` |
-| `e77d5f3beaef` | certain | Move to {…} | `modules/hall-ui/public/deploy.js:371` |
+| `e77d5f3beaef` | certain | Move to {…} | `modules/hall-ui/public/deploy.js:383` |
 | `393139f648b8` | certain | Moving to core | `modules/hall-ui/public/deploy.js:140` |
 | `ae84ebe1d735` | certain | Name cannot be blank. | `modules/hall-ui/public/settings.js:761` |
 | `31e91ee6ce03` | certain | Name must be {…} characters or fewer. | `modules/hall-ui/public/settings.js:766` |
@@ -676,7 +677,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2a6d7552e21f` | certain | No other sessions. | `modules/hall-ui/public/settings-sessions.js:64` |
 | `9f73b3f3dad0` | certain | No rank floor — any builder can claim this task | `modules/hall-ui/public/task-lib.js:62` |
 | `3fd0c6fcb92e` | certain | No request and no invite needed. Sign in with GitHub, and a step-by-step guide takes you the rest of the way. | `modules/hall-ui/public/hall-render.js:277` |
-| `2947c1ddea9a` | certain | No running box to deploy. | `modules/hall-ui/public/deploy.js:348` |
+| `2947c1ddea9a` | certain | No running box to deploy. | `modules/hall-ui/public/deploy.js:360` |
 | `9fb9f766450d` | certain | No sections yet | `modules/hall-ui/public/primer.js:130` |
 | `bef9fe43ba84` | certain | No sessions recorded yet. They land here as builders ship and end sessions. | `modules/hall-ui/public/sessions.js:146` |
 | `4485497d87bb` | certain | No specialities yet. Create one below — it takes a name and a craft, and you can train it afterwards. | `modules/hall-ui/public/settings-specialities.js:169` |
@@ -708,7 +709,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `fec5d78497e8` | certain | Nothing in the backlog right now. | `modules/hall-ui/public/work.js:1107` |
 | `905e99f158c2` | certain | Nothing is discarded by omission: every task needs a decision before this can be submitted. Abandoning stamps  | `modules/hall-ui/public/goals-render.js:1012` |
 | `2ec0fbb20a42` | certain | Nothing is waiting. A spark appears here when its author offers a quick idea up for development. | `modules/hall-ui/public/ideas.js:843` |
-| `9ac63d97239a` | certain | Nothing newer is published that this box can take. There is nothing to deploy. | `modules/hall-ui/public/deploy.js:292` |
+| `9ac63d97239a` | certain | Nothing newer is published that this box can take. There is nothing to deploy. | `modules/hall-ui/public/deploy.js:303` |
 | `073d7fb013ae` | certain | Nothing of yours is {…} right now. | `modules/hall-ui/public/thinking.js:311` |
 | `ad9a17a8a5eb` | certain | Nothing shipped yet. | `modules/hall-ui/public/profile.js:242` |
 | `ad9a17a8a5eb` | certain | Nothing shipped yet. | `modules/hall-ui/public/work.js:1068` |
@@ -899,7 +900,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7e1d54119e08` | certain | Select task {…} for bulk release | `modules/hall-ui/public/work.js:242` |
 | `ae43a132699b` | certain | Selectable today | `modules/hall-ui/public/government.js:799` |
 | `53cc6d8dd23c` | certain | Send invitation | `modules/hall-ui/public/goals-render.js:1211` |
-| `a39b0f9d86e5` | certain | Serving {…} — read from the box itself, {…}. | `modules/hall-ui/public/deploy.js:295` |
+| `a39b0f9d86e5` | certain | Serving {…} — read from the box itself, {…}. | `modules/hall-ui/public/deploy.js:306` |
 | `64a1f055129e` | certain | Session card richness | `modules/hall-ui/public/settings-render.js:83` |
 | `d14e8e9acaff` | certain | Session ended. | `modules/hall-ui/public/settings-sessions.js:81` |
 | `55e0a34bafed` | certain | Session log{…} | `modules/hall-ui/public/task.js:487` |
@@ -954,7 +955,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `ec1c2dae4a90` | certain | Standing there | `modules/hall-ui/public/profile.js:314` |
 | `eaad12cacb9d` | certain | Start over | `modules/hall-ui/public/studio.js:235` |
 | `efe530c0e3a7` | certain | Still open | `modules/hall-ui/public/profile.js:494` |
-| `490a3cbb8c1c` | certain | Still working on core {…}. It keeps going without this page — reload to see where it got to. | `modules/hall-ui/public/deploy.js:407` |
+| `490a3cbb8c1c` | certain | Still working on core {…}. It keeps going without this page — reload to see where it got to. | `modules/hall-ui/public/deploy.js:419` |
 | `9a4ced1afb6c` | certain | Stop waiting on task {…} | `modules/hall-ui/public/task.js:278` |
 | `b0861c874a2f` | certain | Stopped using it. | `modules/hall-ui/public/settings-specialities.js:200` |
 | `6c6544f5c011` | certain | Stored encrypted; never shown again after saving — only its last four digits. | `modules/hall-ui/public/settings.html:193` |
@@ -1082,7 +1083,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/government.html:37` |
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/project-settings.html:36` |
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/watch.html:40` |
-| `f93fcb24c6ba` | certain | This platform | `modules/hall-ui/public/deploy.js:340` |
+| `f93fcb24c6ba` | certain | This platform | `modules/hall-ui/public/deploy.js:352` |
+| `3c8aaec39c40` | certain | This project's code expects {…} database change{…} that its database has not applied yet. Anything that relies | `modules/hall-ui/public/deploy.js:286` |
 | `6e9dfe1fb903` | certain | This restarts {…} onto core | `modules/hall-ui/public/deploy.js:269` |
 | `69e8beced2ff` | certain | This sends the idea back to its author. Say why, and which section. | `modules/hall-ui/public/board-room.js:363` |
 | `09256febc32d` | certain | This sentence has {…} {…} where a value is dropped in when it is shown. | `modules/hall-ui/public/copy-desk.js:422` |
@@ -1348,7 +1350,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2fb1dad96280` | certain | pending, on the People tab | `modules/hall-ui/public/watch.html:46` |
 | `3b22c5af029b` | certain | rank or above, or that it is your own. | `modules/hall-ui/public/copy-desk.html:47` |
 | `80ddf28baee7` | certain | rank-key (kebab-case) | `modules/hall-ui/public/government.html:82` |
-| `41a4b66c21e5` | certain | reads the control plane's own observation · ADR 0293 · every move is recorded with who asked | `modules/hall-ui/public/deploy.js:352` |
+| `41a4b66c21e5` | certain | reads the control plane's own observation · ADR 0293 · every move is recorded with who asked | `modules/hall-ui/public/deploy.js:364` |
 | `f83f0a9d6b6a` | certain | recorded, on the Operations tab | `modules/hall-ui/public/watch.html:49` |
 | `26da1df6fd4a` | certain | reflects it. | `modules/hall-ui/public/settings.html:136` |
 | `d4bb81532896` | certain | repro steps, context, anything that helps… | `modules/hall-ui/public/ideas.html:84` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1922,
-    "unique_ids": 1661,
-    "certain": 1922,
+    "strings": 1924,
+    "unique_ids": 1663,
+    "certain": 1924,
     "heuristic": 0,
     "duplicate_ids": 179
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 92,
-      "strings": 1427
+      "strings": 1429
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -1067,7 +1067,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/deploy.js:269",
-        "modules/hall-ui/public/deploy.js:371"
+        "modules/hall-ui/public/deploy.js:383"
       ]
     },
     {
@@ -4122,7 +4122,7 @@
       "surface": "builders-hall",
       "text": "Could not read this project's deploy state: {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 310,
+      "line": 322,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4558,6 +4558,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "cf7d7d5d5e83",
+      "surface": "builders-hall",
+      "text": "Database behind.",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 286,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "6744aed3d15e",
       "surface": "builders-hall",
@@ -6930,7 +6939,7 @@
       "surface": "builders-hall",
       "text": "Move to {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 371,
+      "line": 383,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -7263,7 +7272,7 @@
       "surface": "builders-hall",
       "text": "No running box to deploy.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 348,
+      "line": 360,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7551,7 +7560,7 @@
       "surface": "builders-hall",
       "text": "Nothing newer is published that this box can take. There is nothing to deploy.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 292,
+      "line": 303,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9270,7 +9279,7 @@
       "surface": "builders-hall",
       "text": "Serving {…} — read from the box itself, {…}.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 295,
+      "line": 306,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9765,7 +9774,7 @@
       "surface": "builders-hall",
       "text": "Still working on core {…}. It keeps going without this page — reload to see where it got to.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 407,
+      "line": 419,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -10917,7 +10926,16 @@
       "surface": "builders-hall",
       "text": "This platform",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 340,
+      "line": 352,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
+    {
+      "id": "3c8aaec39c40",
+      "surface": "builders-hall",
+      "text": "This project's code expects {…} database change{…} that its database has not applied yet. Anything that relies on {…} may fail until the migrations run.",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 286,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -13311,7 +13329,7 @@
       "surface": "builders-hall",
       "text": "reads the control plane's own observation · ADR 0293 · every move is recorded with who asked",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 352,
+      "line": 364,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -2388,5 +2388,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.955 with no explicit bump. run 35691908420. (task 1002620)
   1.19.957 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.956 with no explicit bump. run 35692861666. (task 1002620)
+  1.19.958 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.957 with no explicit bump. run 35735231183. (task 1002620)
+  1.19.959 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.958 with no explicit bump. run 35740227000. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/government/protected-surfaces.json

@@ -26,7 +26,13 @@
   "permission": "path.protected.modify",
   "surfaces": [
     { "glob": "src/bongos/auth.js", "group": "authz", "why": "requireBuilder / requireRank definitions" },
+    { "glob": "src/bongos/auth-admission.js", "group": "authz", "why": "task 1004024. Carved out of auth.js (task 1003206): the OAuth flows, session-token minting, admission and IdP checks auth.js now delegates to. Registering auth.js alone protected the facade and none of them." },
+    { "glob": "src/bongos/auth-config.js", "group": "authz", "why": "task 1004024. Carved out of auth.js (task 1003206): the OAuth flows, session-token minting, admission and IdP checks auth.js now delegates to. Registering auth.js alone protected the facade and none of them." },
+    { "glob": "src/bongos/auth-discord.js", "group": "authz", "why": "task 1004024. Carved out of auth.js (task 1003206): the OAuth flows, session-token minting, admission and IdP checks auth.js now delegates to. Registering auth.js alone protected the facade and none of them." },
+    { "glob": "src/bongos/auth-github.js", "group": "authz", "why": "task 1004024. Carved out of auth.js (task 1003206): the OAuth flows, session-token minting, admission and IdP checks auth.js now delegates to. Registering auth.js alone protected the facade and none of them." },
+    { "glob": "src/bongos/auth-idp.js", "group": "authz", "why": "task 1004024. Carved out of auth.js (task 1003206): the OAuth flows, session-token minting, admission and IdP checks auth.js now delegates to. Registering auth.js alone protected the facade and none of them." },
     { "glob": "src/bongos/db.js", "group": "authz", "why": "rank tiers, REQUIRES_RANK_TIER — the CASE edited in the SEC #863 incident" },
+    { "glob": "src/bongos/db-kernel.js", "group": "authz", "why": "task 1004024. The kernel db slice carved out of db.js (BV1.R69 / ADR 0091): builder identity and the rank reads the SEC #863 entry above exists for." },
     { "glob": "src/bongos/route-rank-check.js", "group": "authz", "why": "the route-gate auditor" },
     { "glob": "src/bongos/permission-path-check.js", "group": "authz", "why": "the matcher that reads this registry (self-protect)" },
     { "glob": "src/bongos/middleware/", "group": "authz", "why": "audit + any auth middleware" },
@@ -43,11 +49,40 @@
     { "glob": "scripts/gds/box-infra.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: reads process.env.CLOUDFLARE_API_TOKEN and process.env.CLOUDFLARE_ACCOUNT_ID into the CF config the box plane provisions against." },
     { "glob": "scripts/gds/cf-tunnel.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: defaults its token parameter to process.env.CLOUDFLARE_API_TOKEN, so it reads the credential whenever a caller omits one. Not named by the recorded decision — the recomputation found it, which is the whole argument for computing the set instead of transcribing it." },
     { "glob": "scripts/gds/box.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: reads process.env.DO_API_TOKEN — the DigitalOcean control plane for the box fleet. Also not named by the recorded decision. Registering it does NOT widen any module wall: the dev-box module key already lists this file and already derives protected:true from the modules/dev-box/ entries above, so the derived protected-module set is unchanged (verified before and after against src/bongos/module-scope-map.js)." },
+    { "glob": "scripts/gds/box-auth-check.js", "group": "box-access", "why": "task 1004024. Split out of the box.js family and never registered; box-infra.js was already listed by name above." },
+    { "glob": "scripts/gds/box-sync.js", "group": "box-access", "why": "task 1004024. Split out of the box.js family and never registered; box-infra.js was already listed by name above." },
     { "glob": "scripts/gds/do-api.js", "group": "box-access", "why": "task 1002891. The DigitalOcean API client the token is handed TO. Unlike the five above it reads no process.env value — it takes the token as a parameter and throws when a live call has none — so the drift tripwire does not demand it and its absence from that computed set is expected, not a bug. It is registered because the recorded decision named it and because it is the code that puts the credential on the wire." },
     { "glob": "modules/grading/grader.js", "group": "pipeline", "why": "BV1.R73: grading carved to modules/grading/ — the glob follows the file" },
+    { "glob": "modules/grading/grader-config.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
+    { "glob": "modules/grading/grader-model.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
+    { "glob": "modules/grading/grader-no-artifact.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
+    { "glob": "modules/grading/grader-prompt.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
+    { "glob": "modules/grading/grader-score.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
+    { "glob": "modules/grading/grader-subagent.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
     { "glob": "modules/grading/grader-workers/", "group": "pipeline", "why": "the adversarial panel (Narc/Hacker/Quality/Efficiency) — blunting these blunts the gate" },
     { "glob": "modules/grading/grader-rubric.json", "group": "pipeline", "why": "the grader's scoring rubric (ADR 0058)" },
     { "glob": "scripts/gds/ship.js", "group": "pipeline", "why": "the ship lifecycle driver" },
+    { "glob": "scripts/gds/ship-check.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-deploy-target.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-escalation.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-finish.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-flow.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-git.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-grade-steps.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-grade.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-honesty.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-io.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-land.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-memory-sync.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-merge-gate.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-merge.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-preflight-steps.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-regen.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-resume.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-session-upload.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-state.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-surprise.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
+    { "glob": "scripts/gds/ship-visual.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
     { "glob": "scripts/gds/confirm.js", "group": "pipeline", "why": "the confirm step" },
     { "glob": "scripts/gds/merge-mode.js", "group": "pipeline", "why": "the manual land fallback" },
     { "glob": "scripts/gds/ci-grade.js", "group": "pipeline", "why": "CI grade-gate driver — steers the grade check (ADR 0058)" },

package/modules/hall-ui/public/deploy.js

@@ -277,6 +277,17 @@
       </div>`;
   }
 
+  // "Database behind" (task 1004153): the box's code ships migrations its database has not
+  // applied, e.g. after an upgrade with --skip-migrate. Silent at 0 AND at null — null is an
+  // unknown reading, and the no-answer note above already speaks for a box that did not answer.
+  function schemaBehindHtml(p) {
+    const n = p.schema_pending;
+    if (!Number.isInteger(n) || n <= 0) return '';
+    return `<p class="ps-invalid"><strong>Database behind.</strong> This project's code expects
+      ${escapeHtml(String(n))} database change${n === 1 ? '' : 's'} that its database has not applied yet.
+      Anything that relies on ${n === 1 ? 'it' : 'them'} may fail until the migrations run.</p>`;
+  }
+
   // One box's card. `isSelf` only changes the words, never what is offered: the runner
   // treats the platform's own row and a tenant's identically, and a page that implied
   // otherwise would be describing a rule that does not exist.
@@ -299,6 +310,7 @@
         ${p.reading === 'no_answer'
           ? `<p class="ps-invalid">The box did not answer when the control plane last looked, so this version is unknown rather than unchanged. A move is not offered while that is true.</p>`
           : ''}
+        ${schemaBehindHtml(p)}
         ${action}
       </div></li>`;
   }

package/modules/provisioning/core-upgrade.js

@@ -259,6 +259,9 @@ function previewFromSnapshot(inst, snap, openIntent, lastMove) {
     // Named so the UI cannot accidentally render "up to date" over a missing reading.
     reading: served ? 'ok' : 'no_answer',
     observed_at: (snap && snap.observed_at) || null,
+    // Migrations the box's code ships that its database has not applied (task 1004153).
+    // null is UNKNOWN, not zero — an old core, or a box that did not answer.
+    schema_pending: snap && Number.isInteger(snap.schema_pending) ? snap.schema_pending : null,
     // What the upgrade SAYS it would do, from the runner's dry run (task 1004121).
     // Withheld unless it was taken against the move now on offer: a verdict about
     // 1.19.920 tells the owner nothing true about pressing a button that says 1.19.921,

package/modules/provisioning/migrations/provisioning_024_snapshot_schema_pending.sql

@@ -0,0 +1,17 @@
+-- provisioning_024 — each box's schemaPending in the core-version snapshot (task 1004153,
+-- from idea 1001088).
+--
+-- /version reports `schemaPending`: core + enabled-module migrations the running code ships
+-- that the instance's own database has not recorded. Only the instance a checkout talks to
+-- was ever watched for it (the SessionStart divergence line); co-tenants were not. A
+-- co-tenant upgraded with --skip-migrate (mercury has no scripts.migrate) serves new code
+-- over an old schema and nothing said so. The runner already reads each box's loopback
+-- /version on every tick for served_version; this stores the other half of that answer.
+--
+-- NULL means UNKNOWN — the box did not answer, or runs a core older than the field — and
+-- is a different state from 0. The control must not render one as the other.
+--
+-- Additive, idempotent, no down-migration.
+
+ALTER TABLE provisioning_core_version_snapshot
+  ADD COLUMN IF NOT EXISTS schema_pending integer;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.957",
+  "version": "1.19.959",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.957",
+      "version": "1.19.959",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.957",
+  "version": "1.19.959",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/provision-core-upgrade.js

@@ -72,6 +72,21 @@ function parseServedVersion(stdout) {
   return m ? m[0] : null;
 }
 
+/**
+ * The `schemaPending` count from a /version body — migrations the box's code ships that its
+ * own database has not recorded (task 1004153). PURE.
+ *
+ * null means UNKNOWN (no answer, not JSON, or a core older than the field), never 0: a
+ * co-tenant that cannot say must not read as one whose database is current. Bounded the
+ * same way scripts/gds/deploy-divergence.js bounds it, since the body is a network answer.
+ */
+function parseSchemaPending(stdout) {
+  if (!stdout || typeof stdout !== 'string') return null;
+  let n;
+  try { n = JSON.parse(stdout).schemaPending; } catch { return null; }
+  return Number.isInteger(n) && n >= 0 && n <= 100000 ? n : null;
+}
+
 /**
  * Is this target a version the instance may actually be moved to? PURE.
  *
@@ -466,7 +481,9 @@ async function snapshotCoreVersions(inst, deps) {
   const instanceDir = inst.hosting_shape === 'standalone' ? standaloneRoot(inst) : selfRoot();
   try {
     const probe = boxExec(versionCmd(inst), { allowFail: true });
-    const served = parseServedVersion(probe && !probe.softFailed ? (probe.stdout || '') : null);
+    const body = probe && !probe.softFailed ? (probe.stdout || '') : null;
+    const served = parseServedVersion(body);
+    const schemaPending = parseSchemaPending(body);
     const listed = channelMod.listAvailableVersions({ cwd: instanceDir });
     const available = (listed && listed.versions) || [];
     // What the channel would take FROM the version the box is actually on. Resolving it
@@ -486,18 +503,19 @@ async function snapshotCoreVersions(inst, deps) {
     const preflight = null;
     await db.query(
       `INSERT INTO provisioning_core_version_snapshot
-         (instance_id, served_version, available, recommended, observed_at, preflight, preflight_at)
-       VALUES ($1, $2, $3::jsonb, $4, now(), $5::jsonb, $6)
+         (instance_id, served_version, available, recommended, observed_at, preflight, preflight_at, schema_pending)
+       VALUES ($1, $2, $3::jsonb, $4, now(), $5::jsonb, $6, $7)
        ON CONFLICT (instance_id) DO UPDATE
          SET served_version = EXCLUDED.served_version, available = EXCLUDED.available,
              recommended = EXCLUDED.recommended, observed_at = now(),
+             schema_pending = EXCLUDED.schema_pending,
              -- A tick with nothing to preview must not ERASE the last verdict; it simply
              -- has nothing newer to say. Only a real dry run overwrites one.
              preflight = COALESCE(EXCLUDED.preflight, provisioning_core_version_snapshot.preflight),
              preflight_at = COALESCE(EXCLUDED.preflight_at, provisioning_core_version_snapshot.preflight_at)`,
       [inst.id, served, JSON.stringify(available), recommended || null,
-       preflight ? JSON.stringify(preflight) : null, preflight ? new Date() : null]);
-    return { ok: true, served, available: available.length, preflight };
+       preflight ? JSON.stringify(preflight) : null, preflight ? new Date() : null, schemaPending]);
+    return { ok: true, served, available: available.length, preflight, schemaPending };
   } catch (e) {
     log(`  ~ core-version snapshot for ${inst.slug} skipped (${(e && e.message) || e})`);
     return { ok: true, skipped: true };
@@ -519,4 +537,4 @@ async function snapshotAllCoreVersions(deps) {
   return { seen };
 }
 
-module.exports = { UPGRADE_SHAPES, resolveRunAs, versionCmd, parseServedVersion, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };
+module.exports = { UPGRADE_SHAPES, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };

package/src/bongos/module-scope-map.js

@@ -48,6 +48,9 @@ const MODULE_GLOBS = {
     'src/bongos/auth.js', 'src/bongos/db.js', 'src/bongos/db-kernel.js', 'src/bongos/pool.js',
     'src/bongos/routes.js', 'src/bongos/route-rank-check.js',
     'src/bongos/permission-path-check.js', 'src/bongos/sensitive-surfaces.js',
+    // task 1004024: the auth.js carve (db-kernel.js, above, is db.js's), now protected.
+    'src/bongos/auth-admission.js', 'src/bongos/auth-config.js', 'src/bongos/auth-discord.js',
+    'src/bongos/auth-github.js', 'src/bongos/auth-idp.js',
     'src/bongos/middleware/', 'src/bongos/live-channel.js', 'src/bongos/secret-box.js',
     'src/bongos/repo-info.js', 'src/bongos/api-path-404.js', 'src/bongos/serve-internal.js',
     'src/bongos/module-scope-map.js', 'src/bongos/hierarchy-config.js',
@@ -91,6 +94,14 @@ const MODULE_GLOBS = {
   lifecycle: [
     'modules/lifecycle/',
     'scripts/gds/ship.js', 'scripts/gds/claim.js', 'scripts/gds/release.js',
+    // task 1004024: the 2026-08-23 ship.js carve, now protected (by name: no '*' here).
+    'scripts/gds/ship-check.js', 'scripts/gds/ship-deploy-target.js', 'scripts/gds/ship-escalation.js',
+    'scripts/gds/ship-finish.js', 'scripts/gds/ship-flow.js', 'scripts/gds/ship-git.js',
+    'scripts/gds/ship-grade-steps.js', 'scripts/gds/ship-grade.js', 'scripts/gds/ship-honesty.js',
+    'scripts/gds/ship-io.js', 'scripts/gds/ship-land.js', 'scripts/gds/ship-memory-sync.js',
+    'scripts/gds/ship-merge-gate.js', 'scripts/gds/ship-merge.js', 'scripts/gds/ship-preflight-steps.js',
+    'scripts/gds/ship-regen.js', 'scripts/gds/ship-resume.js', 'scripts/gds/ship-session-upload.js',
+    'scripts/gds/ship-state.js', 'scripts/gds/ship-surprise.js', 'scripts/gds/ship-visual.js',
     'scripts/gds/merge-mode.js', 'scripts/gds/confirm.js', 'scripts/gds/main-audit.js',
     'scripts/gds/gate-review.js', 'scripts/gds/push-main.js', 'scripts/gds/ci-grade.js',
     'scripts/gds/merge-lock.js', 'scripts/gds/version-close.js',
@@ -355,6 +366,7 @@ const MODULE_GLOBS = {
     'modules/dev-box/', 'devbox-app/',
     'scripts/gds/box.js', 'scripts/gds/box-auth-check.js', 'scripts/gds/box-connect-lib.js',
     'scripts/gds/smoke-box.sh',
+    'scripts/gds/box-sync.js', // task 1004024: split out of box.js, now protected
   
     // ADOPTED (task 1004111): the box BRING-UP surface. box.js (already here)
     // orchestrates these five provisioning CLIs, and infra/ is the shell-script

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.957'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.959'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/core_upgrade_door.mjs

@@ -404,6 +404,15 @@ await t('no snapshot at all reports observed_at:null rather than a confident-loo
   assert.equal(p.available_count, 0);
 });
 
+await t('schema_pending passes through as a count, and UNKNOWN stays null rather than reading as 0 (task 1004153)', () => {
+  const snap = { served_version: '1.19.758', available: [], recommended: null, observed_at: 'x' };
+  assert.equal(CU.previewFromSnapshot(previewInst, { ...snap, schema_pending: 3 }, null).schema_pending, 3);
+  assert.equal(CU.previewFromSnapshot(previewInst, { ...snap, schema_pending: 0 }, null).schema_pending, 0);
+  assert.equal(CU.previewFromSnapshot(previewInst, { ...snap, schema_pending: null }, null).schema_pending, null);
+  assert.equal(CU.previewFromSnapshot(previewInst, snap, null).schema_pending, null, 'a row written before provisioning_024');
+  assert.equal(CU.previewFromSnapshot(previewInst, undefined, null).schema_pending, null, 'no snapshot at all');
+});
+
 await t('an open intent is surfaced with its target, so the page can say what is already running', () => {
   const p = CU.previewFromSnapshot(previewInst, { served_version: '1.19.758', available: [], recommended: null },
     { action: 'core-upgrade', state: 'running', target_version: '1.19.762' });

package/tests/core_upgrade_runner.mjs

@@ -30,6 +30,8 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
+// An ESM named import, not R.parseSchemaPending: knip credits a CJS export only when a test imports it this way.
+import { parseSchemaPending } from '../scripts/gds/provision-core-upgrade.js';
 
 const require = createRequire(import.meta.url);
 const R = require('../scripts/gds/provision-core-upgrade.js');
@@ -404,6 +406,37 @@ await t('a box that does not answer still writes a snapshot — a NULL reading i
   assert.equal(w.params[3], null, 'and nothing is recommended against a version we could not read');
 });
 
+await t('parseSchemaPending reads the count, and anything it cannot trust is null — never 0 (task 1004153)', () => {
+  assert.equal(parseSchemaPending(JSON.stringify({ coreVersion: '1.19.953', schemaPending: 3 })), 3);
+  assert.equal(parseSchemaPending(JSON.stringify({ coreVersion: '1.19.953', schemaPending: 0 })), 0);
+  assert.equal(parseSchemaPending(JSON.stringify({ coreVersion: '1.19.700' })), null, 'a core older than the field');
+  assert.equal(parseSchemaPending(JSON.stringify({ schemaPending: null })), null, 'the box itself does not know');
+  for (const bad of [-1, 1.5, '3', 100001]) {
+    assert.equal(parseSchemaPending(JSON.stringify({ schemaPending: bad })), null, `schemaPending=${JSON.stringify(bad)}`);
+  }
+  assert.equal(parseSchemaPending('cloudbongos 1.19.762 (ok)'), null, 'not JSON');
+  assert.equal(parseSchemaPending(''), null);
+  assert.equal(parseSchemaPending(null), null);
+});
+
+await t('the snapshot stores the box\'s schemaPending next to its served version (task 1004153)', async () => {
+  const queries = [];
+  const d = makeDeps({ queries });
+  d.exec = (cmd) => ({ ok: true, stdout: /\/version/.test(cmd) ? JSON.stringify({ coreVersion: '1.19.760', schemaPending: 4 }) : '' });
+  const r = await R.snapshotCoreVersions(inst(), d);
+  const w = queries.find((q) => /provisioning_core_version_snapshot/.test(q.sql));
+  assert.match(w.sql, /schema_pending = EXCLUDED\.schema_pending/, 'a re-read replaces the old count');
+  assert.equal(w.params[6], 4);
+  assert.equal(r.schemaPending, 4);
+});
+
+await t('a box that does not answer stores schema_pending NULL, not a clean 0', async () => {
+  const queries = [];
+  await R.snapshotCoreVersions(inst(), makeDeps({ served: null, queries }));
+  const w = queries.find((q) => /provisioning_core_version_snapshot/.test(q.sql));
+  assert.equal(w.params[6], null);
+});
+
 await t('a shape the runner cannot reach is skipped entirely — no snapshot, no claim about it', async () => {
   const queries = [];
   const r = await R.snapshotCoreVersions(inst({ hosting_shape: 'dedicated' }), makeDeps({ queries }));

package/tests/deploy_page_projects.mjs

@@ -181,6 +181,20 @@ test('a box that did not answer is never rendered as up to date', async () => {
   assert.doesNotMatch(html, /id="dp-preview-1"/, 'and is offered no move');
 });
 
+test('a box whose database is behind its code says so (task 1004153)', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { schema_pending: 2 }) });
+  await b.settle();
+  assert.match(b.panel(), /Database behind\.<\/strong> This project's code expects\s+2 database changes/);
+});
+
+test('a database that is current, or whose state is unknown, gets no "behind" flag', async () => {
+  for (const schema_pending of [0, null, undefined]) {
+    const b = boot({ controlPlane: preview('1', 'cloudbongos', { schema_pending }) });
+    await b.settle();
+    assert.doesNotMatch(b.panel(), /Database behind/, `schema_pending=${schema_pending}`);
+  }
+});
+
 test('an unenrolled control plane still lets the projects through', async () => {
   // The regression this pins: the platform's own missing row used to be the whole
   // page, so one un-run setup command would hide every project too.

package/tests/government_protected_surfaces.mjs

@@ -116,6 +116,14 @@ const EXPECTED_GLOBS_BEFORE_R101 = [
 // If the owner does want the agents module rank-walled, it needs the entry here,
 // a publish-manifest carve-out, and the module-scope-map roster test updated —
 // three deliberate edits, not a side effect of a scope fix.
+// One ADDED_SINCE_R101 entry per file carved out of `parent`, chained so each sits directly
+// below the previous one — the order the registry lists them in.
+function carve(parent, names, why) {
+  const dir = path.posix.dirname(parent);
+  const globs = names.map((n) => `${dir}/${n}.js`);
+  return globs.map((glob, i) => ({ after: i ? globs[i - 1] : parent, glob, why }));
+}
+
 const ADDED_SINCE_R101 = [
   // task 1003366, audit ref MIT1 (2026-08-29 security audit, goal 1000084). The EIGHT
   // execution roots the merge resolver runs out of a cloned branch. The audit named four
@@ -263,6 +271,30 @@ const ADDED_SINCE_R101 = [
        + 'sub-Metic builders out of in spirit, so the real cost of this entry is three '
        + 'tasks that arguably should not have been open.',
   },
+  // task 1004024, owner decision 2026-09-22 (all five families). Each protected FILE below
+  // had been carved into `<name>-*.js` siblings and only the facade stayed registered. The
+  // carve tripwire further down is what found the four beyond the one the task named.
+  // Listed BY NAME, not as `<name>-*.js`: path-match (the goal scope wall) reads no '*'.
+  ...carve('src/bongos/auth.js', ['auth-admission', 'auth-config', 'auth-discord', 'auth-github', 'auth-idp'],
+    'the auth.js carve: session-token minting and the OAuth exchange, admission and '
+    + 'first-admin seating, IdP assertion checks.'),
+  ...carve('src/bongos/db.js', ['db-kernel'],
+    'the kernel slice carved out of db.js: builder identity and the rank reads the '
+    + 'SEC #863 entry exists for.'),
+  ...carve('scripts/gds/box.js', ['box-auth-check', 'box-sync'],
+    'the box.js family: the dev-box session-start auth gate and the box sync; box-infra.js '
+    + 'was already listed by name.'),
+  ...carve('modules/grading/grader.js', ['grader-config', 'grader-model', 'grader-no-artifact',
+    'grader-prompt', 'grader-score', 'grader-subagent'],
+    'the grader.js carve: the deterministic permission-path pre-pass and the server-side '
+    + 'score guards a model cannot talk past.'),
+  ...carve('scripts/gds/ship.js', ['ship-check', 'ship-deploy-target', 'ship-escalation',
+    'ship-finish', 'ship-flow', 'ship-git', 'ship-grade-steps', 'ship-grade', 'ship-honesty',
+    'ship-io', 'ship-land', 'ship-memory-sync', 'ship-merge-gate', 'ship-merge',
+    'ship-preflight-steps', 'ship-regen', 'ship-resume', 'ship-session-upload', 'ship-state',
+    'ship-surprise', 'ship-visual'],
+    'the 2026-08-23 ship.js carve: the land path, the ship state machine, the grade gate '
+    + 'steps and pushVia, ~6,200 lines behind a 373-line protected entry point.'),
 ];
 
 // Surfaces RENAMED since R101 — still protected, under a new path. Distinct from
@@ -392,6 +424,55 @@ test('every execution root in the closure is a protected surface (MIT1 drift tri
   }
 });
 
+// ---------- the carve tripwire: a protected FILE's `<name>-*.js` siblings are protected ----------
+//
+// task 1004024. Splitting a protected file into `<name>-<phase>.js` siblings is this repo's
+// carve convention, and every carve so far left only the facade registered: ship.js (21
+// files), grader.js (6), auth.js (5), db.js, box.js. A require()-graph rule was measured and
+// rejected — from the protected scripts it reaches 52 unprotected files (upgrade.js, login.js,
+// package-core.js…), floor-gating ordinary work. The name rule is the shape a carve leaves.
+function stemSiblings(entry, tracked) {
+  const dir = path.posix.dirname(entry);
+  const prefix = `${path.posix.basename(entry, '.js')}-`;
+  return tracked.filter((f) => path.posix.dirname(f) === dir
+    && path.posix.basename(f).startsWith(prefix) && f.endsWith('.js'));
+}
+
+test('no protected glob uses a wildcard — the goal scope wall could not read it', () => {
+  // permission-path-check reads '*', but module-scope-map derives ownership and the
+  // protected module set through path-match, which knows only an exact path or a '/'
+  // prefix. A wildcard here would protect files no module can own (task 1004024).
+  assert.deepEqual(ppc.PROTECTED_GLOBS.filter((g) => g.includes('*')), []);
+});
+
+test('stemSiblings finds a split-out file and nothing that merely resembles one', () => {
+  const tree = ['scripts/gds/ship.js', 'scripts/gds/ship-land.js', 'scripts/gds/shipper.js',
+    'scripts/gds/ship_x.js', 'scripts/gds/sub/ship-x.js', 'scripts/gds/ship-notes.md', 'src/ship-y.js'];
+  assert.deepEqual(stemSiblings('scripts/gds/ship.js', tree), ['scripts/gds/ship-land.js']);
+});
+
+test('every file split out of a protected file is itself protected (1004024 carve tripwire)', () => {
+  const tracked = execFileSync('git', ['ls-files', '*.js'], { cwd: ROOT, encoding: 'utf8' })
+    .split('\n').map((s) => s.trim()).filter(Boolean);
+  const entries = ppc.PROTECTED_GLOBS.filter((g) => g.endsWith('.js') && !g.includes('*'));
+  let checked = 0;
+  for (const entry of entries) {
+    const floor = ppc.RANK_TIER[ppc.surfaceFor(entry).floor];
+    for (const rel of stemSiblings(entry, tracked)) {
+      checked += 1;
+      const surface = ppc.surfaceFor(rel);
+      assert.ok(surface,
+        `${rel} sits beside the protected ${entry} under its name — the shape a carve leaves — `
+        + 'but no protected surface covers it. Register it by name in '
+        + 'modules/government/protected-surfaces.json, declare it in ADDED_SINCE_R101, and '
+        + 'give it the parent\'s owning module in src/bongos/module-scope-map.js.');
+      assert.ok(ppc.RANK_TIER[surface.floor] >= floor,
+        `${rel} is floored at '${surface.floor}', below the ${entry} it was carved from.`);
+    }
+  }
+  assert.ok(checked >= 35, `fixture sanity: expected the five known carves (35 files), saw ${checked}`);
+});
+
 // ---------- the credential tripwire: every credential READER is a protected surface ----------
 //
 // task 1002891, from idea 1000692 (the grader's hacker worker, on the 1002690 re-grade).